Security monitoring method and system based on large model embedded in smart screen

Abstract

The present invention relates to the field of electronic digital data processing technology, and specifically discloses a security monitoring method and system based on a large model embedded in a smart screen. First, the multimodal input data of the large model is collected to form an input task data domain, and a comparison data domain is generated using a generative adversarial network. Next, the two data domains are compared, and relevant information is extracted to evaluate the degree of difference between the data domains. Then, the value is compared with the preset threshold interval to determine whether the input task data domain is an authorized task data domain. If it is an authorized task data domain, the large model performs inference, and real-time security monitoring is performed during the inference process. Once an anomaly is found, the inference process is adjusted accordingly based on the specific situation to ensure the safe operation of the large model.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic digital data processing, and in particular to a safety monitoring method and system based on a large model embedded in a smart screen. Background Art

[0002] Leveraging their powerful learning and processing capabilities, large models have achieved remarkable results in fields such as natural language processing and computer vision. In smart screens, large models enable intelligent features such as voice interaction and image recognition, significantly enriching the user experience. From home entertainment to commercial displays, the application scenarios of smart screens continue to expand. With the widespread adoption of smart screens, the security and privacy protection of large models are becoming increasingly important. Protecting the security and privacy of large models within smart hardware has become a critical issue for smart device manufacturers and developers.

[0003] For example, the invention patent with publication number CN119167358A discloses an effective network security incident monitoring method and system based on a big data model, including: automatically collecting data activity records from multiple data sources in the enterprise network; cleaning and formatting the data activity records; extracting leakage features related to data leakage behavior in the data activity records, building a data leakage incident monitoring model based on the leakage features, and monitoring data leakage incidents in real time; setting monitoring thresholds according to historical data leakage situations, and triggering an early warning mechanism when the monitoring results exceed the threshold; tracking and tracing data leakage incidents to find the source of data leakage.

[0004] For example, the invention patent with publication number CN118981789A discloses a system for protecting sensitive information of large models. The system for protecting sensitive information of large models includes the following steps: S1, user identity registration and authorization management; S2, formulation of access control policies; S3, construction of sensitive information database; S4, sensitive information inspection of input and generated content; S5, user behavior monitoring and risk assessment; S6, log recording and security auditing; through various measures such as authorization management, access control, sensitive information inspection, behavior monitoring and security auditing of user use, security management and control of large model applications are achieved.

[0005] Combining the above technical solutions, it is found that the existing large model security monitoring technical solutions ignore the dynamic balance between the security and performance of large models when protecting large models in different scenarios, which can easily lead to a significant decline in model performance while enhancing the security of large models, and even make the equipment unable to work normally. Summary of the Invention

[0006] In response to the deficiencies of the prior art, the present invention provides a security monitoring method and system based on a large model embedded in a smart screen, which can effectively solve the problems involved in the above-mentioned background technology.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions: The first aspect of the present invention provides a security monitoring method based on a large model embedded in a smart screen, including: collecting multimodal input data of the current large model to form the input task data domain of the large model, and generating the input task comparison data domain of the large model based on a generative adversarial network; comparing the input task data domain of the large model with the input task comparison data domain of the large model, extracting data domain comparison information, and evaluating the data domain difference degree value of the large model; comparing the data domain difference degree value of the large model with the predefined preset data domain difference threshold intervals to determine whether the input task data domain of the large model is the authorized task data domain of the large model; the large model infers the authorized task data domain, performs security monitoring on the embedding process of the large model in real time, and finally performs security adjustments on the inference process of the large model.

[0008] As a further method, the data domain difference value of the large model is evaluated, and the specific evaluation process is as follows: the data domain comparison information includes the mean difference of each feature dimension of the large model data domain and the relative entropy of the large model data domain; the generation information of the large model input task comparison data domain is collected, including the discriminator loss value of the large model and the generator loss value of the large model; the discriminator loss value of the large model and the generator loss value of the large model are multiplied and added with the corresponding weight parameters respectively to obtain the generation device influence degree value of the large model, and matched with the difference degree influence factor corresponding to the predefined generation device influence degree value interval to obtain the difference degree influence factor of the large model; the mean difference of each feature dimension of the large model data domain and the relative entropy of the large model data domain are normalized to remove the unit, and data aggregation processing is performed with the difference degree influence factor of the large model to obtain the data domain difference degree value of the large model.

[0009] As a further method, whether the input task data domain of the large model is the authorized task data domain of the large model is determined. Specifically, the data domain difference degree value of the large model is compared with each preset data domain difference threshold interval to obtain a difference degree comparison result, and based on the difference degree comparison result, whether the input task data domain of the large model is the authorized task data domain of the large model is determined; if the data domain difference degree value of the large model belongs to the first difference threshold interval, the input task data domain is determined to be normal input, and the input task data domain of the large model is recorded as the authorized task data domain of the large model; if the data domain difference degree value of the large model belongs to the second difference threshold interval, weight verification is triggered; if the data domain difference degree value of the large model belongs to the third difference threshold interval, the current input task data domain is determined to be abnormal input, and an early warning is triggered.

[0010] As a further method, weight verification, the specific analysis process is: through the reinforcement learning controller to screen the filters that affect the functionality of the large model, record them as key filters, and extract the original weight parameters corresponding to the key filters; compare the original weight parameters with the predefined weight parameter confusion interval, and record the original weight parameters belonging to the weight parameter confusion interval as the key weights of the large model. The reinforcement learning controller generates a key weight mask for the key weights; compare the key weights of the large model with the key weight mask, evaluate the weight confusion variability of the large model, and continue to determine whether the input task data domain of the large model is the authorized task data domain of the large model.

[0011] As a further method, continue to determine whether the input task data domain of the large model is the authorized task data domain of the large model. The specific determination process is: compare the weight confusion variability of the large model with the preset weight variation threshold intervals. If the weight confusion variability of the large model belongs to the first variation threshold interval, then determine that the large model weight verification is normal, and record the input task data domain of the large model as the authorized task data domain of the large model; if the weight confusion variability of the large model belongs to the second variation threshold interval, extract the mask parameter index and the allowed variation amplitude interval in the authorization key stored in the current large model, and compare them with the input task data domain of the large model and the input task comparison data of the large model. The position index and variation range of the actual mutation parameters between the domains are compared. If the position index and variation range of the actual mutation parameters both belong to the mask parameter index in the authorization key and the allowed variation range, the actual mutation parameters are judged to be reasonable differences within the authorization range, the local authorization status is updated to temporary trust, and the input task data domain of the large model is recorded as the authorized task data domain of the large model. Otherwise, the actual mutation parameters are judged to be unreasonable mutations, and an emergency response is triggered. If the weight confusion variation of the large model belongs to the third variation threshold range, the input task data domain of the large model is the unauthorized task data domain of the large model, and the large model is judged to be abnormally used, triggering an emergency response.

[0012] As a further method, the embedding process of the large model is security monitored in real time. The specific analysis process is: perform watermark embedding operation on the authorization task data domain of the large model to generate a watermark model; perform security monitoring on the embedding process of the large model in real time, periodically extract the watermark information from the minor bits of the authorization task data domain of the large model, reconstruct the watermark model, and compare the watermark model with the reconstructed watermark model. If the watermark model and the reconstructed watermark model are the same, continue security monitoring; if the watermark model and the reconstructed watermark model are different, collect the execution feature information of the large model, determine the feature integrity index of the large model, and make security adjustments to the reasoning process of the large model.

[0013] The second aspect of the present invention provides a security monitoring system based on a large model embedded in a smart screen, including: a comparison data domain generation module, used to collect multimodal input data of the current large model to form the input task data domain of the large model, and generate the input task comparison data domain of the large model based on a generative adversarial network; a data domain difference evaluation module, used to compare the input task data domain of the large model with the input task comparison data domain of the large model, extract data domain comparison information, and evaluate the data domain difference degree value of the large model; an authorized data domain judgment module, used to compare the data domain difference degree value of the large model with predefined preset data domain difference threshold intervals to determine whether the input task data domain of the large model is the authorized task data domain of the large model; a large model security monitoring module, used for the large model to infer the authorized task data domain, perform security monitoring of the embedding process of the large model in real time, and finally perform security adjustments to the inference process of the large model.

[0014] Compared with the prior art, the embodiments of the present invention have at least the following advantages or beneficial effects:

[0015] (1) The present invention provides a security monitoring method and system based on a large model embedded in a smart screen. First, the multimodal input data of the large model is collected to form an input task data domain, and a comparison data domain is generated using a generative adversarial network. Next, the two data domains are compared, and relevant information is extracted to evaluate the degree of difference between the data domains. This value is then compared with a preset threshold interval to determine whether the input task data domain is an authorized task data domain. If it is an authorized task data domain, the large model performs inference, and real-time security monitoring is performed during the inference process. Once an anomaly is found, the inference process is adjusted accordingly based on the specific situation to ensure the safe operation of the large model.

[0016] (2) The present invention extracts data domain comparison information, compares the input task data domain with the generated comparison data domain, and evaluates the data domain difference degree value of the large model. It can accurately determine whether the current input data belongs to the task scope authorized by the model, identify cross-domain risks, and prevent task abuse. At the same time, due to the complex distribution of multimodal input data of the smart screen, the data domain difference evaluation processes the feature differences of different modes through normalization and weighted aggregation, which can ensure that the model maintains stable performance for diversified data within the authorized domain, allowing the large model to dynamically adapt to multimodal input and improve its robustness.

[0017] (3) The present invention collects key weight comparison information of the large model to determine the weight confusion variation of the large model, and monitors in real time whether the core parameters of the model have been illegally modified. Even if the model is illegally copied, the confusion weights obtained by unauthorized users will cause a significant decrease in inference accuracy, effectively preventing hardware cracking or software reverse engineering from stealing the core parameters of the model, thereby resisting parameter tampering attacks and ensuring model integrity. The weight confusion variation is combined with the mask parameter index and the allowed variation range in the authorization key to distinguish between legal changes and illegal tampering, realize refined authorization management, and prevent out-of-bounds use. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The present invention is further described with reference to the accompanying drawings. However, the embodiments in the accompanying drawings do not constitute any limitation to the present invention. A person skilled in the art can obtain other drawings based on the following drawings without creative effort.

[0019] Figure 1 Schematic diagram of the method steps of the present invention.

[0020] Figure 2 This is a schematic diagram of system module connections of the present invention.

[0021] Figure 3 It is a schematic diagram of the process structure of the present invention.

[0022] Figure 4 Detailed flow chart of the steps of the present invention. DETAILED DESCRIPTION

[0023] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0024] Reference Figure 1 As shown, the first aspect of the present invention provides a security monitoring method based on a large model embedded in a smart screen, including: collecting multimodal input data of the current large model to form an input task data domain of the large model, and generating an input task comparison data domain of the large model based on a generative adversarial network.

[0025] A GAN (Generative Adversarial Network) refers to a GAN architecture with domain-enhanced authorization. It consists of a generator (G) and a discriminator (D). The generator receives random noise and a one-hot encoding as input and generates training samples. The discriminator determines whether the input data sample is real or generated and assigns a corresponding label. During training, the generator attempts to generate realistic samples to confuse the discriminator, while the discriminator strives to distinguish the authenticity of the data, creating an adversarial relationship between the two. The discriminator consists of a feature extraction module and two classifiers. The feature extractor extracts features from the input samples, the first classifier determines whether the input is real or generated, and the second classifier determines the class label of the extracted features. During training, the mean squared error (MSE) loss is used to help the discriminator distinguish between real and generated samples. In the joint optimization of generation and discrimination, the KL divergence is used to constrain the label distribution of the generated data to be close to the target label, ensuring that the generated samples are not only realistic but also conform to the specified label. The KL (Kullback-Leibler) divergence is a measure of the asymmetry between two probability distributions. It quantifies the "distance" between one probability distribution and another.

[0026] The input task data domain of the above-mentioned large model refers to the multimodal input data set corresponding to the specific task currently processed by the large model, which includes various data features and their distribution in the task scenario, and is the direct data input source for the model to perform reasoning. Its core is a data set that is strongly related to the current task and has a specific distribution, such as user interaction data of smart screens in different functional scenarios. For example, for the voice control task of a smart TV, the data types may include voice data, touch data, environmental data, etc. The data domain characteristics are that when command words such as "open" and "play" appear frequently in the voice text, the touch coordinates are concentrated in the function button area at the bottom of the screen, and the image contains a preset application icon layout.

[0027] In this embodiment, a task-specific model generation framework based on domain locking is designed, such as Figure 3 The domain locking model shown generates, Figure 3 This is a schematic diagram of the process structure of the present invention. It uses a generative adversarial network (GAN) to construct comparison domain data with a different distribution from the authorized data domain. Through KL divergence loss and maximum mean difference (MMD) loss optimization, the model achieves excellent performance in the authorized domain, while significantly degrading performance in other domains. This framework enables refined adaptation to task scenarios, introduces a cross-domain comparison mechanism into representation learning for the first time, and proposes a new authorization model that balances performance and applicability.

[0028] Compare the input task data domain of the large model with the input task comparison data domain of the large model, extract data domain comparison information, and evaluate the data domain difference degree value of the large model.

[0029] Specifically, the data domain difference value of the large model is evaluated. The specific evaluation process is as follows:

[0030] The above-mentioned data domain comparison information includes the mean difference of each characteristic dimension of the large model data domain and the relative entropy of the large model data domain, wherein the data domain comparison information can be extracted from the data domain comparison log of the large model.

[0031] The mean difference of each feature dimension in the large model data domain is obtained by collecting the mean of each feature dimension in the large model input task data domain and the mean of each feature dimension in the large model input task comparison data domain, and performing difference processing to obtain the mean difference of each feature dimension in the large model data domain. Assuming that the input task data domain is , the input task comparison data domain is , for the i-th feature dimension, the means are and , then the mean difference can be expressed as:

[0032] Collect the generation information of the large model input task comparison data domain, including the discriminator loss value of the large model and the generator loss value of the large model. The discriminator loss value can be calculated by the discriminator loss function, and the generator loss can be calculated by the generator loss function.

[0033] The discriminator loss value of the large model and the generator loss value of the large model are multiplied by the corresponding weight parameters and added together to obtain the generation device influence value of the large model, and matched with the difference influence factor corresponding to the predefined generation device influence value interval to obtain the difference influence factor of the large model.

[0034] The generation device influence value of the above-mentioned large model is specifically obtained by multiplying the discriminator loss value of the large model with the weight parameter corresponding to the discriminator loss value predefined in the model monitoring information library to obtain the first influence value of the generation device; multiplying the generator loss value of the large model with the weight parameter corresponding to the generator loss value predefined in the model monitoring information library to obtain the second influence value of the generation device, and adding the first influence value of the generation device to the second influence value of the generation device to obtain the generation device influence value of the large model.

[0035] The weight parameters corresponding to the discriminator loss value and the weight parameters corresponding to the generator loss value are both extracted from the model monitoring information library, and the mapping relationship can be a one-to-one correspondence or a many-to-one relationship. For example, the discriminator loss value and the generator loss value respectively form a mapping set with the weight parameters corresponding to the discriminator loss value and the weight parameters corresponding to the generator loss value preset in the model monitoring information library. The real-time discriminator loss value and the generator loss value are brought into the mapping set to obtain the weight parameters corresponding to the discriminator loss value and the weight parameters corresponding to the generator loss value.

[0036] The mean difference of each characteristic dimension of the large model data domain and the relative entropy of the large model data domain are normalized to remove the unit, and data aggregation processing is performed with the difference degree influencing factor of the large model to obtain the data domain difference degree value of the large model. The specific analysis method is as follows:

[0037]

[0038] Where, is the data domain difference value of the large model, is the mean difference of the i-th feature dimension in the large model data domain, i is the number of each feature dimension, , N is the total number of feature dimensions, is the relative entropy of the large model data domain, is the weight parameter corresponding to the mean difference of feature dimensions predefined in the model monitoring information library, is the weight parameter corresponding to the relative entropy predefined in the model monitoring information library, is the influencing factor of the difference degree of the large model.

[0039] The weight parameters corresponding to the mean difference of the feature dimension and the weight parameters corresponding to the relative entropy are both extracted from the model monitoring information library, and the mapping relationship can be a one-to-one correspondence or a many-to-one relationship. For example, the mean difference of the feature dimension and the relative entropy respectively form a mapping set with the weight parameters corresponding to the mean difference of the feature dimension and the weight parameters corresponding to the relative entropy preset in the model monitoring information library. The real-time mean difference of the feature dimension and the relative entropy are brought into the mapping set to obtain the weight parameters corresponding to the mean difference of the feature dimension and the weight parameters corresponding to the relative entropy.

[0040] In this embodiment, a multivariate analysis of the mean difference, relative entropy, and influencing factors for each feature dimension is performed, specifically considering the correlation between these parameters. The mean difference and relative entropy complement each other: the mean difference is based on the specific feature dimension, while the relative entropy considers the overall distribution, jointly characterizing the difference characteristics of the data domain. If the mean difference between feature dimensions is large, it often indicates that the data distribution varies significantly across each feature, which may also lead to an increase in relative entropy. Because the overall probability distribution difference increases with the increase in feature distribution difference, it has a negative impact on the degree of data domain difference of the large model. Conversely, a large relative entropy may also indicate a large mean difference between feature dimensions, which also has a negative impact on the degree of data domain difference of the large model. Furthermore, when the mean difference between feature dimensions is large, it indicates that the input task data domain and the comparison data domain are significantly different. This may make it more difficult for the GAN to generate comparison data, resulting in changes in the discriminator loss and generator loss, which in turn affects the influencing factors for the degree of difference and, therefore, the degree of data domain difference of the large model.

[0041] The data domain difference degree value of the large model is compared with the predefined data domain difference threshold intervals to determine whether the input task data domain of the large model is the authorized task data domain of the large model.

[0042] Furthermore, it is determined whether the input task data domain of the large model is the authorized task data domain of the large model. Specifically, the data domain difference degree value of the large model is verified with each preset data domain difference threshold interval to obtain a verification result, and based on the verification result, it is determined whether the input task data domain of the large model is the authorized task data domain of the large model.

[0043] If the data domain difference value of the large model belongs to the first difference threshold interval, the input task data domain is determined to be normal input, and the input task data domain of the large model is recorded as the authorized task data domain of the large model.

[0044] If the data domain difference value of the large model falls within the second difference threshold range, weight verification is triggered;

[0045] If the data domain difference value of the large model falls within the third difference threshold range, the current input task data domain is determined to be abnormal input and an early warning is triggered.

[0046] The above-mentioned warning is specifically achieved by limiting the output of large models, blocking sensitive function buttons, recording abnormal interaction logs, and reporting risk events to the cloud management platform.

[0047] Specifically, the weight verification and analysis process are as follows:

[0048] The filters that affect the functionality of the large model are screened through the reinforcement learning controller, recorded as key filters, and the original weight parameters corresponding to the key filters are extracted.

[0049] By introducing a mask M to identify the weights that need to be obfuscated, the number of obfuscated weights can be reduced as much as possible, thereby reducing the security risks of storing and transmitting obfuscated weights as keys. The definition of mask M is as follows:

[0050]

[0051] in, is the original weight parameter, and is an adjustable hyperparameter. Through this mask, we can selectively confuse the - , + ], while the weights that do not fall within this interval remain unchanged. By masking we can optimize the weight changes , generating new weight changes Among them, the symbol Represents the multiplication operation of corresponding elements in the matrix, by choosing constant , the effect of weight confusion can be distributed to different layers of the model. Afterwards, the adjusted weight changes are applied Norm regularization encourages the sparsity of weight changes, that is, reducing the number of non-zero elements, only storing changes in important weights, reducing the security risk of transmitting them as keys, compressing storage requirements, and combining the distributed design of mask M with Norm regularization performs weight confusion while reducing dependence on storage resources.

[0052] The above reinforcement learning controller mainly consists of three parts: state encoder, policy network and output decoder. Select a filter index k where ,and Indicates the The total number of filters (or output channels) of the layer. is determined by the architecture of the target large model M, and the agent's environment is static. If n filters are selected for each layer, the agent will execute a total of actions (L is the number of layers), these actions are used All agents share a weight parameter The controller is optimized to maximize the expected reward :

[0053] in, Represents a given controller parameter In the case of Strategy distribution of The reward signal used to guide the controller, E is the expected function. The controller is encouraged to choose filters that significantly reduce the model accuracy after confusion, which is defined as follows:

[0054] in, Represents a large model Data validation set The prediction accuracy of .

[0055] The original weight parameters are compared with the predefined weight parameter confusion interval, and the original weight parameters belonging to the weight parameter confusion interval are recorded as the key weights of the large model. The reinforcement learning controller generates a key weight mask for the key weights, where the original weight parameters belonging to the weight parameter confusion interval are represented as the weight parameters that need to be confused and are marked by a mask.

[0056] Compare the key weights of the large model with the key weight mask, evaluate the weight confusion variability of the large model, and continue to determine whether the input task data domain of the large model is the authorized task data domain of the large model.

[0057] It should be explained that in this embodiment, weight verification can determine whether the input task data domain is an authorized task data domain. Its core logic is to implement authorized control of model functions by verifying the legitimacy of key weights. Specifically, by comparing the actual weights with the authorized weight template in the authorization key, it determines whether the current weights are within the authorized variation range. The key filters selected by the reinforcement learning controller correspond to the weight parameters in the model that have the greatest impact on core functions (such as speech recognition and image classification). These weights directly determine the model's performance on authorized tasks (for example, the voice interaction function of a smart screen relies on specific filters to extract semantic features). The key weight mask generated by reinforcement learning only discloses the true weight index and allowed variation range (stored in the authorization key) to authorized users. Even if unauthorized users obtain the model, they cannot unlock the key weights and can only use obfuscated, invalid weights (resulting in a significant decrease in inference accuracy). Weight verification is a progressive complement to data domain discrepancy assessment. Together, the two constitute a dual verification process: "input legitimacy → model function legitimacy."

[0058] In this embodiment, Figure 3 The reinforcement learning driven weight confusion shown, Figure 3This is a schematic diagram of the process structure of the present invention. Based on a reinforcement learning-driven weight obfuscation and key protection mechanism, the obfuscation level of the model parameters is dynamically adjusted by generating a weight mask, achieving dual-layer authorization protection for the model. This mechanism ensures that the model is only valid for users holding the authorization key. Even if the model is accessed by an unauthorized user, its core functionality cannot be unlocked. Compared with traditional authorization mechanisms, this method improves the flexibility and security of authorization without significantly affecting model performance.

[0059] Furthermore, the weight confusion variability of the large model is evaluated. The specific evaluation process is as follows:

[0060] Collect key weight comparison information of the large model, including the cosine similarity of each key weight of the large model, the relative difference ratio value of each key weight of the large model, and the key weight confusion ratio of the large model. The key weight comparison information is specifically extracted from the weight comparison log of the large model.

[0061] The algorithm iteration number of the reinforcement learning controller is collected, where the algorithm iteration number can be extracted from the execution report of the reinforcement learning controller, and matched with the weight confusion influence element corresponding to each predefined algorithm iteration number interval to obtain the weight confusion influence element of the large model.

[0062] The relative difference ratio of each key weight in the large model is calculated by calculating the ratio of the absolute value of the difference between the key weight and the element corresponding to the key weight mask to the absolute value of the element corresponding to the key weight. The key weight confusion ratio of the large model is specifically the ratio of the number of elements in the key weight that fall within the preset weight parameter confusion range to the total number of key weight elements.

[0063] The cosine similarity of each key weight of the large model, the relative difference ratio of each key weight of the large model, and the key weight confusion ratio of the large model are normalized to remove the unit, and data aggregation is performed with the weight confusion influence element of the large model to obtain the weight confusion variation of the large model. The specific analysis method is as follows:

[0064]

[0065] Where, is the weight confusion variability of the large model, is the cosine similarity of the jth key weight of the large model, j is the number of each key weight, j=1,2,3,...,M, M is the total number of key weights, is the relative difference ratio value of the jth key weight of the large model, is the key weight confusion ratio of the large model, The weight confusion of the large model affects the element, is the weight parameter corresponding to the key weight cosine similarity predefined in the model monitoring information library, is the weight parameter corresponding to the relative difference ratio value of the key weights predefined in the model monitoring information library, The weight parameter corresponding to the key weight confusion ratio predefined in the model monitoring information library.

[0066] It should be explained that the cosine similarity of each key weight of the above-mentioned large model refers to the cosine similarity between each key weight of the large model and the corresponding key weight mask.

[0067] The weight parameters corresponding to the key weight cosine similarity, the weight parameters corresponding to the key weight relative difference ratio value, and the weight parameters corresponding to the key weight confusion ratio are all extracted from the model monitoring information library, and the mapping relationship can be a one-to-one correspondence or a many-to-one relationship. For example, the key weight cosine similarity, the key weight relative difference ratio value, and the key weight confusion ratio respectively form a mapping set with the weight parameters corresponding to the key weight cosine similarity, the weight parameters corresponding to the key weight relative difference ratio value, and the weight parameters corresponding to the key weight confusion ratio preset in the model monitoring information library. The real-time key weight cosine similarity, the key weight relative difference ratio value, and the key weight confusion ratio are brought into the mapping set to obtain the weight parameters corresponding to the key weight cosine similarity, the weight parameters corresponding to the key weight relative difference ratio value, and the weight parameters corresponding to the key weight confusion ratio.

[0068] In this embodiment, a multivariate analysis of the key weight cosine similarity, key weight relative difference ratio, key weight confusion ratio, and weight confusion influencer of the large model is performed. Specifically, the correlation between these parameters is considered. The key weight cosine similarity and key weight relative difference ratio of the large model reflect weight changes from different perspectives. When the cosine similarity is high, the relative difference ratio value is often low, and the weight confusion variability of the large model is low. Conversely, when the cosine similarity is low, the relative difference ratio value may be high, and the weight confusion variability of the large model increases. When the key weight confusion ratio increases, it means that more key weights are in the confusion range, which may lead to a decrease in the cosine similarity of each key weight and an increase in the relative difference ratio value of each key weight, which also increases the weight confusion variability of the large model. The weight confusion influencer plays a regulatory role. When the weight confusion influencer is large, it amplifies the influence of other parameters on the weight confusion variability. During the reinforcement learning process, if the algorithm has a large number of iterations, the weight confusion influencer increases. Even if the cosine similarity of each key weight, the relative difference ratio value of each key weight, and the key weight confusion ratio originally change slightly, the final weight confusion variability may increase significantly.

[0069] Specifically, continue to determine whether the input task data domain of the large model is the authorized task data domain of the large model. The specific determination process is as follows:

[0070] The weight confusion variation of the large model is compared with the preset weight variation threshold intervals. If the weight confusion variation of the large model belongs to the first variation threshold interval, the large model weight verification is determined to be normal, and the input task data domain of the large model is recorded as the authorized task data domain of the large model.

[0071] If the weight confusion variation of the large model belongs to the second variation threshold range, the mask parameter index and the allowed variation range in the authorization key stored in the current large model are extracted, and compared with the position index and variation range of the actual variation parameter between the input task data domain of the large model and the input task comparison data domain of the large model. If the position index and variation range of the actual variation parameter both belong to the mask parameter index and the allowed variation range in the authorization key, the actual variation parameter is determined to be a reasonable difference within the authorized range, and the local authorization status is updated to temporary trust, and the input task data domain of the large model is recorded as the authorized task data domain of the large model. Otherwise, the actual variation parameter is determined to be an unreasonable variation, and an emergency response is triggered.

[0072] If the large model's weight confusion variation falls within the third variation threshold, the large model's input task data domain is considered unauthorized, and abnormal use of the large model is determined, triggering an emergency response. This emergency response immediately freezes the large model's reasoning function, automatically rolling back the weight parameters to the most recently authorized state, and simultaneously sending a real-time alert to the device administrator.

[0073] The big model infers the authorized task data domain, conducts security monitoring of the embedding process of the big model in real time, and finally makes security adjustments to the inference process of the big model.

[0074] Furthermore, the embedding process of the large model is monitored in real time for security. The specific analysis process is as follows:

[0075] The authorization task data domain of the large model is watermarked and embedded to generate a watermark model. The watermark embedding operation is specifically based on the IEEE754 floating point standard, and the watermark information is embedded in the mantissa (minor bit) of the large model parameter to generate the watermark model.

[0076] Collecting large model parameters All the sign bits and exponent bits, that is, the main bits, are recorded as Then, the restored bit R is obtained by matrix multiplication. Specifically, the recovered bits are calculated using the following formula:

[0077] in, Is a pseudo-random binary matrix generated by the authorization key, with a size of .

[0078] The model parameters and recovery bits are divided into groups of u elements each, and the number of groups is divided into g groups. For each group, the main bit C and the recovery bit R are input into the hash function to generate h hash bits. After generating the hash bits for each group, all the recovery bits and hash bits are combined to form a watermark. Finally, the model watermark is embedded into the minor bits of the model by replacing the minor bits to generate the watermark model. .

[0079] The embedding process of the large model is monitored in real time for security. The watermark information is periodically extracted from the minor bits of the authorization task data field of the large model, the watermark model is reconstructed, and the watermark model is compared with the reconstructed watermark model. If the watermark model and the reconstructed watermark model are the same, security monitoring is continued. If the watermark model and the reconstructed watermark model are different, the execution feature information of the large model is collected, the feature integrity index of the large model is determined, and the reasoning process of the large model is securely adjusted.

[0080] In this embodiment, Figure 3 The watermark embedding and recovery shown, Figure 3 This is a schematic diagram of the process structure of this invention. It innovatively embeds watermarks into the minor bits of model parameters and combines them with a hash algorithm to generate a unique identifier for verifying the integrity and ownership of the model. If the model is attacked or tampered with, the damaged parameters can be located through hash comparison, and the weights can be restored to their original state using the model key. This mechanism not only expands the application scope of watermarking technology but also provides refined tamper detection and repair capabilities for the model, significantly enhancing the integrity and reliability of model protection.

[0081] Specifically, the reasoning process of the large model is adjusted for security. The specific adjustment process is as follows:

[0082] The feature integrity index of the large model is compared with the predefined feature integrity index intervals. If the feature integrity index of the large model belongs to the first integrity index interval, the watermark inconsistency status is uploaded to the cloud management platform for record, and the preset security enhancement measures are executed.

[0083] If the feature integrity index of the large model belongs to the second integrity index range, the functions of the large model with specific tags will be temporarily disabled, only the interactive functions with non-specific tags will be retained, and the watermark detection period will be shortened to the preset length to continuously track the changing trend of the feature integrity index.

[0084] If the characteristic integrity index of the large model belongs to the third integrity index range, it is determined that unauthorized tampering has occurred in the execution of the large model. The tampered parameter position is located through hash comparison, and the parameters are restored using the original weight index stored in the key.

[0085] Watermark recovery is to extract the watermark information from the minor bits of the model, which contain the recovery bits and hash bits, and divide the watermark and the main bits into g groups. For each group, the corresponding hash bits are extracted and compared with the recalculated hash bits to distinguish the tampered recovery bits from the main bits. If the reorganized extracted hash bits are exactly the same as the recalculated hash bits, the group is marked as a complete group, otherwise it is marked as a tampered group. Assume that the total number of complete group recovery bits extracted first is , then the recovery bit formula can be rewritten as:

[0086]

[0087] in, and From K and A matrix consisting of selected rows from (generated by the authorization key) corresponding to the complete A recovery bit, Indicates the index of the complete recovery bit. Divided into complete main and tampering with the main bits Therefore, the formula can be further refined as:

[0088]

[0089] in, and corresponds to and The matrix composed of columns for the main bits in the formula. All other items except This is the main bit that needs to be restored. The problem of restoring the tampered main bit can be transformed into solving the matrix As long as there is a unique solution to the formula, the tampered main bits can be completely restored.

[0090] Furthermore, the feature integrity index of the large model is determined. The specific determination process is as follows:

[0091] The execution feature information of the above-mentioned large model includes the watermark matching degree of the large model and the watermark tampering position ratio of the large model. The execution feature information can be specifically extracted from the execution report of the large model.

[0092] Extract the performance information of the large model. This information can be found in the large model's execution report, including the large model's CPU utilization and inference duration. Multiply the CPU utilization and inference duration of the large model by the corresponding weight factors, and then add them together to obtain the performance impact value of the large model.

[0093] The watermark matching degree of the large model is specifically the degree of matching between the reconstructed watermark model and the original watermark information, that is, the watermark matching degree. The watermark tampering position ratio of the large model is specifically the ratio of the number of tampered positions in the statistical watermark to the total number of watermark positions.

[0094] The above multiplies the CPU utilization of the large model and the inference time of the large model with the corresponding weight factors and adds them together. Specifically, the CPU utilization of the large model is multiplied by the weight factor corresponding to the CPU utilization predefined in the model monitoring information library to obtain the first performance impact value; the inference time of the large model is multiplied by the weight factor corresponding to the inference time predefined in the model monitoring information library to obtain the second performance impact value, and the first performance impact value and the second performance impact value are added to obtain the performance impact value of the large model.

[0095] The weight factors corresponding to the CPU utilization and the weight factors corresponding to the inference time are both extracted from the model monitoring information library, and the mapping relationship can be a one-to-one correspondence or a many-to-one relationship. For example, the CPU utilization and the inference time respectively form a mapping set with the weight factors corresponding to the CPU utilization and the weight factors corresponding to the inference time preset in the model monitoring information library. The real-time CPU utilization and inference time are brought into the mapping set to obtain the weight factors corresponding to the CPU utilization and the weight factors corresponding to the inference time.

[0096] The watermark matching degree of the large model, the proportion of watermark tampering positions of the large model, and the performance impact value of the large model are normalized to remove the unit, and then weighted aggregation is performed in sequence to obtain the feature integrity index of the large model. The specific analysis method is as follows:

[0097]

[0098] Where, is the feature integrity index of the large model, is the watermark matching degree of the large model, The watermark tampering position ratio of the large model, is the performance impact value of the large model, is the weight parameter corresponding to the watermark matching degree predefined in the model monitoring information database, is the weight parameter corresponding to the proportion of watermark tampering positions predefined in the model monitoring information database, It is the weight parameter corresponding to the performance impact value predefined in the model monitoring information library.

[0099] The weight parameters corresponding to the watermark matching degree, the weight parameters corresponding to the watermark tampering position ratio and the weight parameters corresponding to the performance impact value are all extracted from the model monitoring information library, and the mapping relationship can be a one-to-one correspondence or a many-to-one relationship. For example, the watermark matching degree, the watermark tampering position ratio and the performance impact value are respectively mapped with the weight parameters corresponding to the watermark matching degree, the weight parameters corresponding to the watermark tampering position ratio and the weight parameters corresponding to the performance impact value preset in the model monitoring information library to form a mapping set. The real-time watermark matching degree, the watermark tampering position ratio and the performance impact value are brought into the mapping set to obtain the weight parameters corresponding to the watermark matching degree, the weight parameters corresponding to the watermark tampering position ratio and the weight parameters corresponding to the performance impact value.

[0100] In this embodiment, a multivariate analysis of watermark matching, watermark tampering location ratio, and performance impact value is performed, specifically considering the correlation between these variables. The watermark matching and watermark tampering location ratio are negatively correlated. The higher the watermark matching, the more similar the reconstructed watermark is to the original watermark. The lower the watermark tampering location ratio, the less likely the model has been tampered with and the greater the feature integrity of the large model. Conversely, the lower the watermark matching, the higher the watermark tampering location ratio, indicating that the model may have been tampered with more frequently and the smaller the feature integrity of the large model. At the same time, when the watermark matching is high, it indicates that the model performance is relatively stable and the performance impact value may be low, thereby increasing the feature integrity of the model. A low watermark matching may indicate that the model has been tampered with, which can lead to abnormal model operation, increased CPU utilization, and longer inference time, thereby increasing the performance impact value and negatively impacting the feature integrity of the large model.

[0101] In this embodiment, the specific process of security monitoring of the large model is as follows: Figure 4 As shown, Figure 4 This is a detailed flowchart of the steps of the present invention, which is used to describe the detailed process of the embodiment of the present invention. First, the input data of the large model is collected, and then the comparison data is generated and the difference value between the two is calculated. Branching is performed by judging whether the difference value is normal: if it is normal, it enters the large model reasoning, and then undergoes watermark verification. If the verification passes, it will be executed normally. If it fails, it will enter the security processing. If the difference value is abnormal, it will enter the security verification and perform weight verification. If the verification passes, it will be executed normally. If it fails, it will also enter the security processing. Finally, the security processing points to functional restriction or emergency response, forming a complete processing logic.

[0102] Reference Figure 2As shown, the second aspect of the present invention provides a security monitoring system based on a large model embedded in a smart screen, comprising: a comparison data domain generation module, a data domain difference assessment module, an authorized data domain determination module, a large model security monitoring module, and a model monitoring information library. The model monitoring information library is used to store preset values ​​of various factors.

[0103] The comparison data domain generation module is connected to the data domain difference assessment module, the data domain difference assessment module is connected to the authorized data domain judgment module, the authorized data domain judgment module is connected to the large model security monitoring module, and the data domain difference assessment module, the authorized data domain judgment module and the large model security monitoring module are all connected to the model monitoring information database.

[0104] The comparison data domain generation module is used to collect the multimodal input data of the current large model to form the input task data domain of the large model, and generate the input task comparison data domain of the large model based on the generative adversarial network.

[0105] The data domain difference evaluation module is used to compare the input task data domain of the large model with the input task comparison data domain of the large model, extract data domain comparison information, and evaluate the data domain difference degree value of the large model.

[0106] The authorized data domain determination module is used to compare the data domain difference degree value of the large model with the predefined data domain difference threshold intervals to determine whether the input task data domain of the large model is the authorized task data domain of the large model.

[0107] The large model security monitoring module is used for the large model to reason about the authorized task data domain, to conduct security monitoring of the large model embedding process in real time, and finally to make security adjustments to the large model's reasoning process.

[0108] The above content is merely an example and explanation of the structure of the present invention. Those skilled in the art may make various modifications or additions to the described specific embodiments or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the present invention, they should all fall within the scope of protection of the present invention.

Claims

1. A security monitoring method based on a large model embedded in a smart screen, characterized in that: include: Collect the multimodal input data of the current large model to form the input task data domain of the large model. Based on the generative adversarial network, generate the input task comparison data domain of the large model; Compare the input task data domain of the large model with the input task comparison data domain of the large model, extract data domain comparison information, and evaluate the data domain difference degree value of the large model; Compare the data domain difference degree value of the large model with the predefined data domain difference threshold intervals to determine whether the input task data domain of the large model is the authorized task data domain of the large model; The large model infers the authorized task data domain, performs security monitoring on the embedding process of the large model in real time, and finally makes security adjustments to the inference process of the large model; The specific evaluation process of evaluating the data domain difference value of the large model is as follows: The data domain comparison information includes the mean difference of each feature dimension of the large model data domain and the relative entropy of the large model data domain; Collect the generation information of the large model input task comparison data domain, including the discriminator loss value of the large model and the generator loss value of the large model; Multiply the discriminator loss value and the generator loss value of the large model by the corresponding weight parameters and add them together to obtain the generation device influence value of the large model, and match them with the difference influence factors corresponding to the predefined generation device influence value intervals to obtain the difference influence factor of the large model; The mean difference of each characteristic dimension of the large model data domain and the relative entropy of the large model data domain are normalized to remove the unit, and data aggregation processing is performed with the difference degree influencing factor of the large model to obtain the data domain difference degree value of the large model.

2. The security monitoring method based on the large model embedded in the smart screen according to claim 1 is characterized by: The step of determining whether the input task data domain of the large model is the authorized task data domain of the large model specifically involves comparing the difference degree value of the data domain of the large model with each preset data domain difference threshold interval to obtain a difference degree comparison result, and determining whether the input task data domain of the large model is the authorized task data domain of the large model based on the difference degree comparison result; If the difference degree value of the data domain of the large model falls within the first difference threshold interval, the input task data domain is determined to be normal input, and the input task data domain of the large model is recorded as the authorized task data domain of the large model; If the data domain difference value of the large model falls within the second difference threshold range, weight verification is triggered; If the data domain difference value of the large model falls within the third difference threshold range, the current input task data domain is determined to be abnormal input and an early warning is triggered.

3. The security monitoring method based on the large model embedded in the smart screen according to claim 2 is characterized by: The specific analysis process of the weight verification is as follows: The reinforcement learning controller is used to filter out the filters that affect the functionality of the large model, which are recorded as key filters, and the original weight parameters corresponding to the key filters are extracted; The original weight parameters are compared with the predefined weight parameter confusion interval, and the original weight parameters belonging to the weight parameter confusion interval are recorded as the key weights of the large model. The reinforcement learning controller generates a key weight mask for the key weights; Compare the key weights of the large model with the key weight mask, evaluate the weight confusion variability of the large model, and continue to determine whether the input task data domain of the large model is the authorized task data domain of the large model.

4. The security monitoring method based on the large model embedded in the smart screen according to claim 3 is characterized by: The weight confusion variability of the evaluation model is evaluated in the following specific process: Collect key weight comparison information of the large model, including the cosine similarity of each key weight of the large model, the relative difference ratio of each key weight of the large model, and the key weight confusion ratio of the large model; The algorithm iteration number of the reinforcement learning controller is collected and matched with the weight confusion influence element corresponding to each predefined algorithm iteration number interval to obtain the weight confusion influence element of the large model; The cosine similarity of each key weight of the large model, the relative difference ratio of each key weight of the large model, and the key weight confusion ratio of the large model are normalized to remove the unit, and data aggregation is performed with the weight confusion influence element of the large model to obtain the weight confusion variability of the large model.

5. The security monitoring method based on the large model embedded in the smart screen according to claim 3 is characterized by: The process of continuing to determine whether the input task data domain of the large model is the authorized task data domain of the large model is as follows: Compare the weight confusion variation of the large model with the preset weight variation threshold intervals. If the weight confusion variation of the large model falls within the first variation threshold interval, it is determined that the large model weight verification is normal, and the input task data domain of the large model is recorded as the authorized task data domain of the large model. If the weight confusion variation of the large model belongs to the second variation threshold interval, the mask parameter index and the allowed variation range in the authorization key stored in the current large model are extracted, and compared with the position index and variation range of the actual variation parameter between the input task data domain of the large model and the input task comparison data domain of the large model. If the position index and variation range of the actual variation parameter both belong to the mask parameter index and the allowed variation range in the authorization key, the actual variation parameter is determined to be a reasonable difference within the authorization range, the local authorization status is updated to temporary trust, and the input task data domain of the large model is recorded as the authorized task data domain of the large model. Otherwise, the actual variation parameter is determined to be an unreasonable variation, and an emergency response is triggered. If the weight confusion variation of the large model belongs to the third variation threshold interval, the input task data domain of the large model is the unauthorized task data domain of the large model, and it is determined that the large model is used abnormally, triggering an emergency response.

6. The security monitoring method based on the large model embedded in the smart screen according to claim 1 is characterized by: The real-time security monitoring of the embedding process of the large model is carried out, and the specific analysis process is as follows: Perform watermark embedding operation on the authorization task data domain of the large model to generate a watermark model; The embedding process of the large model is monitored in real time for security. The watermark information is periodically extracted from the minor bits of the authorization task data field of the large model, the watermark model is reconstructed, and the watermark model is compared with the reconstructed watermark model. If the watermark model and the reconstructed watermark model are the same, security monitoring is continued. If the watermark model and the reconstructed watermark model are different, the execution feature information of the large model is collected, the feature integrity index of the large model is determined, and the reasoning process of the large model is securely adjusted.

7. The security monitoring method based on the large model embedded in the smart screen according to claim 6 is characterized by: The reasoning process of the large model is adjusted for security, and the specific adjustment process is as follows: Compare the feature integrity index of the large model with the predefined feature integrity index intervals. If the feature integrity index of the large model falls within the first integrity index interval, upload the watermark inconsistency status to the cloud management platform for record, and execute the preset security enhancement measures; If the feature integrity index of the large model falls within the second integrity index range, the large model's functions with specific tags are temporarily disabled, retaining only the interactive functions with non-specific tags, and shortening the watermark detection period to a preset length to continuously track the trend of feature integrity index changes; If the characteristic integrity index of the large model belongs to the third integrity index range, it is determined that unauthorized tampering has occurred in the execution of the large model. The tampered parameter position is located through hash comparison, and the parameters are restored using the original weight index stored in the key.

8. The security monitoring method based on the large model embedded in the smart screen according to claim 6 is characterized by: The specific determination process of determining the feature integrity index of the large model is as follows: Execution feature information of the large model, including the watermark matching degree of the large model and the proportion of watermark tampering positions of the large model; Extract performance information of large models, including CPU utilization and inference time of large models; Multiply the CPU utilization and inference time of the large model by the corresponding weight factors and add them together to obtain the performance impact value of the large model. The watermark matching degree of the large model, the proportion of the watermark tampering position of the large model and the performance impact value of the large model are normalized to remove the unit, and then weighted aggregation is performed in turn to obtain the feature integrity index of the large model.

9. A system using the security monitoring method based on a large model embedded in a smart screen as described in any one of claims 1 to 8, characterized in that: include: The comparison data domain generation module is used to collect the multimodal input data of the current large model to form the input task data domain of the large model. Based on the generative adversarial network, it generates the input task comparison data domain of the large model. The data domain difference evaluation module is used to compare the input task data domain of the large model with the input task comparison data domain of the large model, extract data domain comparison information, and evaluate the data domain difference degree value of the large model; The authorized data domain determination module is used to compare the data domain difference degree value of the large model with the predefined data domain difference threshold intervals to determine whether the input task data domain of the large model is the authorized task data domain of the large model; The large model security monitoring module is used for the large model to reason about the authorized task data domain, to conduct security monitoring of the large model embedding process in real time, and finally to make security adjustments to the large model's reasoning process.

Images